fix(ci): downgrade contents permission to read in claude.yml

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/CLAUDE.md

@@ -0,0 +1,86 @@
+# LeRobot — Claude Code Instructions
+
+You are a senior robotics ML engineer reviewing code for **LeRobot**, a PyTorch framework for real-world robot learning.
+Apply these principles to every PR review, fix, or task.
+
+---
+
+## Core Abstractions
+
+These are the load-bearing types. Handle them with care — breaking changes here affect every user.
+
+| Type             | Location                     | Role                                                         |
+| ---------------- | ---------------------------- | ------------------------------------------------------------ |
+| `LeRobotDataset` | `src/lerobot/datasets/`      | Streaming replay buffer; HF Hub integration                  |
+| `Policy`         | `src/lerobot/policies/`      | Base class for all learning agents (ACT, Diffusion, SARM, …) |
+| `Robot`          | `src/lerobot/robots/`        | Hardware abstraction; carries `_output_pipeline`             |
+| `Teleoperator`   | `src/lerobot/teleoperators/` | Leader-side hardware abstraction; carries `_output_pipeline` |
+| `Env`            | `src/lerobot/envs/`          | Gym-like robotics environments                               |
+| `Processor`      | `src/lerobot/processor/`     | Data transformation pipelines attached to robots/teleops     |
+
+**Never break their public APIs without a migration note and explicit user approval.**
+
+---
+
+## Engineering Principles
+
+### Code quality
+
+- Explicit over magic — no hidden control flow, no implicit state.
+- No deep inheritance trees. Prefer composition.
+- No decorative comment separators (`===`, `---`, etc.).
+- Add comments only where the logic is non-obvious.
+- No over-engineering. YAGNI applies strictly.
+
+### Type safety
+
+- All new and modified Python code must be fully typed (PEP 484).
+- `mypy --strict` must pass on changed files.
+- Do not widen or weaken existing type signatures.
+
+### Backwards compatibility
+
+- Public API changes require migration notes.
+- Additive changes are preferred over modifications.
+- `so100_follower` / `so101_follower` are aliases — never bleed changes there unintentionally.
+
+### HF ecosystem
+
+- Use `push_to_hub()`, HF Hub dataset streaming, and `evaluate` scripts.
+- Dataset changes must preserve streaming compatibility.
+- Prefer reusing HF primitives over rolling custom solutions.
+
+---
+
+## PR Review Checklist
+
+Before approving or marking P1 issues resolved, verify:
+
+- [ ] `pre-commit run -a` would pass (ruff, mypy, typos, zizmor, bandit)
+- [ ] All new/modified code is typed and passes `mypy --strict`
+- [ ] New features have unit tests; no silent behavioral changes
+- [ ] Public APIs of `LeRobotDataset`, `Policy`, `Robot`, `Teleoperator`, `Env` are unchanged (or migration note present)
+- [ ] HF Hub streaming still works for dataset changes
+- [ ] No unnecessary abstractions introduced
+- [ ] No breaking changes to training scripts (`lerobot-train`, `lerobot-eval`, `lerobot-record`)
+
+---
+
+## ML-Specific Checks
+
+Flag these as **P1** if found:
+
+- **Data leakage**: train and val/test splits must be constructed before any normalization or augmentation that uses train statistics.
+- **Loss function errors**: verify reduction mode (`mean` vs `sum`), correct masking, correct shape alignment.
+- **Gradient flow**: new modules must have gradients flowing (check `requires_grad`, no detached tensors in the loss path by accident).
+- **Distributed training**: operations on tensors must be DDP-safe; no in-place ops on parameters; batch norm needs `SyncBatchNorm` if used.
+- **Memory leaks**: no accumulation of tensors outside the training loop; `optimizer.zero_grad()` called correctly.
+
+---
+
+## What to Skip
+
+- Don't flag style nitpicks on unchanged surrounding code.
+- Don't propose refactors outside the PR's scope.
+- Don't add docstrings or comments to code the PR didn't touch.
+- Don't suggest speculative future features (YAGNI).

.github/workflows/claude-code-review.yml

@@ -0,0 +1,49 @@
+name: Claude Code Review
+
+on:
+  pull_request:
+    types: [opened, synchronize, ready_for_review, reopened]
+
+jobs:
+  claude-review:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: read
+      id-token: write
+      actions: read
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Run Claude Code Review
+        id: claude-review
+        uses: anthropics/claude-code-action@26ddc358fe3befff50c5ec2f80304c90c763f6f8 # v1
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          use_sticky_comment: true
+          prompt: |
+            Read `.github/CLAUDE.md` for lerobot-specific conventions, then review this PR.
+            Provide structured, actionable feedback.
+
+            Focus areas (in priority order):
+            1. **Correctness**: Logic errors, off-by-ones, wrong tensor shapes, incorrect loss functions
+            2. **Type safety**: All new/modified Python code must pass `mypy --strict`; check for missing annotations
+            3. **Backwards compatibility**: Does this break `LeRobotDataset`, `Policy`, `Robot`, `Teleoperator`, `Env`, or `Processor` public APIs?
+            4. **Tests**: New features must have tests; no silent behavioral changes
+            5. **Code style**: Explicit over magic, no unnecessary abstractions, no decorative comments
+            6. **HF integration**: Dataset streaming, `push_to_hub`, HF Hub compatibility preserved?
+            7. **pre-commit**: Would `pre-commit run -a` pass? (ruff, mypy, typos, zizmor)
+
+            Format findings as P1 (must fix) / P2 (should fix) / P3 (nice to have).
+            Skip P3 if the PR is already high quality.
+          claude_args: '--model claude-opus-4-6'
+          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
+          # or https://code.claude.com/docs/en/cli-reference for available options

.github/workflows/claude.yml

@@ -0,0 +1,58 @@
+name: Claude Code
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  issues:
+    types: [opened, assigned]
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  claude:
+    if: |
+      (github.event_name == 'issue_comment' &&
+       contains(github.event.comment.body, '@claude') &&
+       (github.event.comment.author_association == 'OWNER' || github.event.comment.author_association == 'MEMBER' || github.event.comment.author_association == 'COLLABORATOR')) ||
+      (github.event_name == 'pull_request_review_comment' &&
+       contains(github.event.comment.body, '@claude') &&
+       (github.event.comment.author_association == 'OWNER' || github.event.comment.author_association == 'MEMBER' || github.event.comment.author_association == 'COLLABORATOR')) ||
+      (github.event_name == 'pull_request_review' &&
+       contains(github.event.review.body, '@claude') &&
+       (github.event.review.author_association == 'OWNER' || github.event.review.author_association == 'MEMBER' || github.event.review.author_association == 'COLLABORATOR')) ||
+      (github.event_name == 'issues' &&
+       (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')) &&
+       (github.event.issue.author_association == 'OWNER' || github.event.issue.author_association == 'MEMBER' || github.event.issue.author_association == 'COLLABORATOR'))
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
+      id-token: write
+      actions: read
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Run Claude Code
+        id: claude
+        uses: anthropics/claude-code-action@26ddc358fe3befff50c5ec2f80304c90c763f6f8 # v1
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          use_sticky_comment: true
+
+          # This is an optional setting that allows Claude to read CI results on PRs
+          additional_permissions: |
+            actions: read
+
+          claude_args: '--system-prompt "Read .github/CLAUDE.md for lerobot-specific conventions before responding."'
+          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
+          # or https://code.claude.com/docs/en/cli-reference for available options